Assigning to the concern owner from Find it results --
The result is a list of CLs that change the crashed files. 

Author: jcivelli
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/0f21bd5836318170c155a0caf8bc6f81a939213d
Time: Wed Dec 07 21:21:33 2016
Lines 49-54 of file child_shared_bitmap_manager.cc which potentially caused crash are changed in this cl (frame #3, "content::").
Minimum distance from crash line to modified line: 0. (file: child_shared_bitmap_manager.cc, crashed on: 49, modified: 49).

@jcivelli -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

This is indeed caused by my change.
Fix is up for review:
https://codereview.chromium.org/2608783003

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/35e5ff5b38c32d2bb9b03c2bc77911e7bf75efd1

commit 35e5ff5b38c32d2bb9b03c2bc77911e7bf75efd1
Author: jcivelli <jcivelli@chromium.org>
Date: Fri Jan 06 18:23:01 2017

Fix ThreadSafeAssociatedInterfacePtrProvider raciness.

Ensures the thread safe interface pointer returned by
ThreadSafeAssociatedInterfacePtrProvider can be called before the
interface pointer is actually bound.

BUG= 675089 
TEST=Run mojo_public_bindings_unittests

Review-Url: https://codereview.chromium.org/2608783003
Cr-Commit-Position: refs/heads/master@{#441981}

[modify] https://crrev.com/35e5ff5b38c32d2bb9b03c2bc77911e7bf75efd1/content/renderer/mojo/thread_safe_associated_interface_ptr_provider.h
[modify] https://crrev.com/35e5ff5b38c32d2bb9b03c2bc77911e7bf75efd1/ipc/ipc_channel_proxy.h
[modify] https://crrev.com/35e5ff5b38c32d2bb9b03c2bc77911e7bf75efd1/mojo/public/cpp/bindings/tests/associated_interface_unittest.cc
[modify] https://crrev.com/35e5ff5b38c32d2bb9b03c2bc77911e7bf75efd1/mojo/public/cpp/bindings/tests/interface_ptr_unittest.cc
[modify] https://crrev.com/35e5ff5b38c32d2bb9b03c2bc77911e7bf75efd1/mojo/public/cpp/bindings/thread_safe_interface_ptr.h

ClusterFuzz has detected this issue as fixed in range 449231:449250.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4878538202415104

Fuzzer: tokenfuzz_pdf_march16
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 8
Crash Address: 0x7b1800001f08
Crash State:
  base::internal::WeakReferenceOwner::GetRef
  mojo::ThreadSafeInterfacePtrBase<content::mojom::RenderMessageFilter, mojo::Asso
  content::mojom::RenderMessageFilterProxy::DeletedSharedBitmap
  
Sanitizer: thread (TSAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=437055:437094
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=449231:449250

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94pqev7oO9BNxJ1mT4j__DfPfLDX5Vh2He1y2EOPzm-9jxHqxNGTiHBIN5wah_DajbaPoIXuzPbUh4NqXto8wRFv8lOW14z7Cs1ZqV7HHz6lmZ84-KRLRZx9SM51sHSZGky8HbxDkKkmfNIDiQsKKXt9aH3cEdLW_bsCqq7MN48h72glyE?testcase_id=4878538202415104


Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.